OurPrivacy Policy

..from Rot-Flüh Hotelbetriebs GmbH
Seestraße 26
A – 6673 Grän
Tel. +43 5675 6431
post@rotflueh.com
 
 
We strive to deliver services and products of outstanding quality. To ensure we can continue to do so in the future and to offer you the best possible service and perfect performance, we collect and process data and activity details from enquiries, bookings, voucher purchases or when you visit our website. We process your data exclusively in accordance with the relevant legal provisions (GDPR, TKG 2003). In this privacy policy, we inform you about the most important aspects of data processing in connection with our website, our Facebook and Instagram accounts, our online shop, our chat services and our newsletter system. When you make a booking with us, make a purchase, submit an enquiry, or request information or brochures, we process your personal data in accordance with Article 6(1)(b) and (f).
 
What data do we collect?
Website: When you use this website, we collect technically necessary data which is automatically transmitted to our server, including your IP address, the date and time of your session, the type of device used, access status/HTTP status code, browser type, language and version of the browser software, and operating system.
This is technically necessary in order to display our website to you. We also use the data to improve the website in line with your expectations and to ensure the security and stability of the website. The legal basis for the collection is Article 6(1)(f) of the GDPR.
Forms: When you contact us via a form on the website or by email, make an enquiry or make a booking, you provide us with personal data (e.g. name, postal address, email address, telephone number, interests, etc.) for processing, which we require in order to deal with your enquiry. We store and process this data. We do not pass this data on to third parties. Exceptions are companies acting on our behalf as data processors with whom we have entered into an agreement stipulating that they must handle your data with the same statutory duty of care as we do. These companies are listed later in this privacy policy.
Cookies
Our website uses cookies. These are small text files that are stored on your device via your browser. They do not cause any harm.
We need cookies to make our website user-friendly. Some cookies remain stored on your device until you delete them. They enable us to recognise your browser the next time you visit.
If you do not wish this to happen, you can configure your browser to notify you when cookies are set and to allow them only on a case-by-case basis.
If you do not allow cookies, not all features of our website may be available.
 
Web Analytics – Google Analytics
We use Google Analytics on our website to analyse and improve the way our website is used.
Google Analytics is a web analytics service provided by Google Inc. Google Analytics uses so-called ‘cookies’, which are text files stored on your computer that enable an analysis of your use of the website. The information generated by cookies regarding your use of this website is usually transmitted to a Google server in the USA and stored there. However, if IP anonymisation is enabled on this website, your IP address will first be truncated by Google within Member States of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website and internet usage. The legal basis for the processing of data using Google Analytics is Article 6(1)(f) of the GDPR. The IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google.
We have entered into a corresponding data processing agreement with the provider.
You can prevent this by configuring your browser so that no cookies are stored. However, please note that in this case, you may not be able to make full use of all the functions of our website. Furthermore, you can prevent the data generated by cookies and relating to your use of the website (including your IP address) from being transmitted to Google, and prevent Google from processing this data, by downloading and installing the browser plug-in available via the following link: http://tools.google.com/dlpage/gaoptout?hl=de
We use Google Analytics with the “_anonymizeIp()” extension. This truncates IP addresses (known as IP masking). This prevents any link to specific individuals. Google participates in the EU-US Privacy Shield, www.privacyshield.gov. This ensures an adequate level of data protection even in exceptional cases where Google transfers personal data to the USA under the EU-US Framework.
Information about Google: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001
Further information on Google’s Terms of Service:
www.google.com/analytics/terms/de.html
Further information on Google’s data protection policy:
www.google.com/intl/de/analytics/privacyoverview.html
 
Google AdWords Conversion Tracking
We use Google AdWords to display adverts to you on websites operated by Google and other third parties. We use conversion tracking to measure the effectiveness of individual advertising campaigns, with the aim of showing you adverts that are of interest to you and making our website more engaging for you. The legal basis for the processing of your data is Article 6(1)(f) of the GDPR.
The adverts are served by Google via ‘ad servers’. To this end, we use cookies which enable us to measure certain parameters for determining success, such as the display of adverts or clicks by users. If you access our website via a Google advert, Google AdWords will store a cookie on your computer. These cookies generally expire after 30 days and are not intended to identify you personally. The following data is typically stored in connection with this cookie as analytical metrics: the unique cookie ID, the number of ad impressions per placement (frequency), the last impression (relevant for post-view conversions) and opt-out information (an indicator that the user no longer wishes to be targeted).
These cookies enable Google to recognise your web browser. If a user visits specific pages on an AdWords client’s website and the cookie stored on their computer has not yet expired, Google and the client can recognise that the user clicked on the advert and was redirected to that page. Each AdWords client is assigned a different cookie. Cookies cannot therefore be tracked across the websites of AdWords clients. We ourselves do not collect or process any personal data in connection with the advertising measures mentioned. We are merely provided with statistical reports by Google. Based on these reports, we can identify which of the advertising measures used are particularly effective. We do not receive any further data resulting from the use of the advertising materials; in particular, we cannot identify users on the basis of this information.
Due to the marketing tools used, your browser automatically establishes a direct connection to Google’s servers. We have no influence over the scope and further use of the data collected by Google and are informing you in accordance with our current knowledge: Through the integration of AdWords Conversion Tracking, Google receives the information that you have visited the relevant part of our website or clicked on one of our adverts. If you are registered with a Google service, Google may associate your visit with your account. Even if you are not registered with Google or are not logged in, it is possible that the provider may obtain and store your IP address.
You can prevent cookies from being stored by adjusting the settings in your browser software; however, we would like to point out that, in this case, you may not be able to use all the features of this website. You can also prevent the collection of data generated by the cookie and relating to your use of the website (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available via the following link: http://www.google.com/settings/ads/plugin
Further information on data protection at Google can be found here:
www.google.com/intl/de/policies/privacy
https://services.google.com/sitestats/en_US.html
 
Google AdWords Remarketing
We use Google AdWords Remarketing. This service enables us to display adverts to you on other websites after you have visited our website. This is achieved using cookies stored in your browser, which Google uses to record and analyse your browsing behaviour when visiting various websites. This allows Google to recognise your previous visit to our website. According to Google’s own statements, the data collected as part of remarketing is not combined with your personal data, which may be stored by Google. In particular, Google states that pseudonymisation is used for remarketing.
 
Google Maps
This website uses the Google Maps service. This enables us to display interactive maps directly on our website and to allow you to use the map function conveniently. When you use Google Maps, data – including your IP address – is transferred to Google in the USA.
You can prevent data from being transmitted to Google by disabling JavaScript in your browser settings. In this case, however, you will not be able to use Google Maps services
The legal basis for the processing of your data is Article 6(1)(f) of the GDPR. Google participates in the EU-US Privacy Shield: www.privacyshield.gov/EU-US-Framework
Information about Google:
Google Inc., 1600 Amphitheatre Parkway, Mountain View, California 94043, USA
Further information on Google’s terms of use:
www.google.com/analytics/terms/de.html
Further information on Google’s privacy policy:
www.google.com/intl/de/analytics/privacyoverview.html
Further information on the Google Maps Terms of Service:
https://www.google.com/intl/de_US/help/terms_maps.html
 
Google Fonts
We use Google Fonts on our website. This enables us to integrate specific fonts into our website. These fonts are provided by Google via servers in the USA. When you visit our website, your web browser establishes a direct connection to these servers. Among other things, your IP address is transmitted to Google and stored there. Google participates in the EU-US Privacy Shield: www.privacyshield.gov/EU-US-Framework
 
Social media plug-ins
We use the following social media plug-ins on our website: Facebook and Instagram. You can recognise these by the icons specific to social media channels or terms such as ‘Like’, ‘Gefällt mir’, etc. In doing so, personal data is transmitted to the respective plug-in provider and stored there.
The respective plug-in provider stores the data collected about you in the form of user profiles and uses this for the purposes of advertising, market research and/or tailoring its website to your needs. Such analysis is carried out in particular (including for users who are not logged in) to display personalised advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles; to exercise this right, you must contact the respective plug-in provider. Through the plug-ins, we offer you the opportunity to interact with social networks and other users, enabling us to improve our service and make it more interesting for you as a user. The legal basis for the use of the plug-ins is Article 6(1)(f) of the GDPR.
Data is transferred regardless of whether you have an account with the plug-in provider and are logged in there. If you are logged in to the plug-in provider’s service, the data we collect about you will be directly linked to your existing account with that provider. In the case of US providers, data is transferred to the USA; these providers have opted into the EU-US Privacy Shield:
www.privacyshield.gov/EU-US-Framework
Further information on the purpose and scope of data collection and its processing by the plug-in provider can be found in these providers’ privacy policies. There you will also find further information on your rights and options for changing your privacy settings:
Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA
www.facebook.com/policy.php
Google Inc., 1600 Amphitheatre Parkway, Mountain View, California 94043, USA
www.google.com/policies/privacy/partners/?hl=de
Twitter, Inc., 1355 Market St, Suite 900, San Francisco, California 94103, USA
www.twitter.com/privacy
Xing AG, Gänsemarkt 43, 20354 Hamburg, DE
www.xing.com/privacy
 
Newsletter
If you wish to subscribe to the newsletter offered on the website, we require your email address and information that enables us to verify that you are the owner of the email address provided and that you consent to receiving the newsletter (double opt-in).
You can easily withdraw your consent at any time using the unsubscribe function in the newsletter you have received. The legal basis for processing is Article 6(1)(a) of the GDPR. We use the data exclusively for sending newsletters.
No further data is collected unless provided on an expressly voluntary basis, e.g. to tailor the content to your interests. This data is stored by us and used exclusively for sending the requested information and for personalising the newsletter. In addition, we carry out link tracking to analyse and continuously improve the newsletter content.
Our newsletters contain so-called web beacons. A web beacon is a miniature graphic embedded in emails sent in HTML format to enable log file recording and analysis. This allows for a statistical evaluation of the success or failure of online marketing campaigns. Using the embedded web beacon, we can determine whether and when you have opened an email and which links contained in the email you have clicked on.
Such personal data collected via the tracking pixels contained in the newsletters is stored and analysed by us, as the data controller, in order to optimise the distribution of the newsletter and to tailor the content of future newsletters even better to your interests. This personal data is not passed on to third parties. You are entitled at any time to withdraw the separate declaration of consent given in this regard via the double opt-in procedure. Following withdrawal, we will delete this personal data. We automatically interpret unsubscribing from the newsletter as a withdrawal of consent.
We use the “NumBirds” service provided by Sports and Tourism Digital Services GmbH, 6020 Innsbruck, Brixner Straße 3/3, to produce the newsletter. To ensure the confidentiality of your personal data, we have entered into a data processing agreement with the company.
When you make a booking with us, make a purchase, submit an enquiry, or request information or brochures, we process your personal data in accordance with Article 6(1), first sentence, points (b) and (f).
 
Voucher
system We use the services of Incert to process your voucher purchases. Under a separate agreement on the processing of personal data, your data is collected and processed on our behalf by INCERT eTourismus GmbH & Co KG, Leonfeldner Strasse 328, 4040 Linz, on our behalf as part of commissioned data processing under Article 28 of the GDPR, in accordance with the relevant legal requirements. As a data processor in the event of support measures, Incert eTourismus also has access to your data; however, it may only use this data for the purpose of support measures and not for its own purposes.
 
Retention period
We process and store your data only for as long as is necessary for the processing or to comply with legal obligations. Once the purpose of the processing no longer applies, your data will be blocked or deleted. Where further legal obligations to retain data exist, we will block or delete your data upon expiry of the statutory retention periods.
Our measures to protect your personal rights
As mentioned at the outset, we take the protection of your personal data very seriously and use it exclusively to stay in touch with you, to optimise our services and to tailor them to your wishes and needs.
We take appropriate measures to prevent unauthorised access to the stored data, as well as theft, disclosure, alteration or destruction.
Our staff are appropriately trained and are obliged to maintain confidentiality and to use your data in accordance with the law.
We have entered
into data processing agreements with service providers to whom we transfer personal data for communication purposes (newsletters, mailings, etc.) or for commercial purposes (bookkeeping, invoicing, booking systems, data management systems, etc.) to safeguard the confidentiality of your personal data. Our website contains links to third-party websites. We are not responsible for these providers’ compliance with the provisions of the GDPR. We therefore recommend that you also check these companies’ privacy policies.
 
Your rights
In particular, the GDPR grants you the following rights regarding your personal data: the right of access (to know whether and which data we store, the purposes of processing, and the duration of storage), the right to rectification and completion, the right to erasure, the right to restriction of processing, the right to data portability, the right to object, and the right to withdraw your consent under data protection law.
You have the right to request confirmation from us as to whether personal data concerning you is being processed. If you wish to exercise this right to confirmation, you may contact our Data Protection Officer at any time.
You have the right to receive, free of charge, information from us at any time regarding the personal data we hold about you. Furthermore, the European legislator has granted you the right to be informed of the purposes of processing, the categories of personal data being processed, the recipients or categories of recipients to whom the personal data have been or will be disclosed – in particular recipients in third countries or international organisations – and, where possible, the envisaged period for which the personal data is stored, or, if this is not possible, the criteria used to determine that period; the existence of automated decision-making, including profiling, in accordance with Article 22(1) and (4) of the GDPR; and — at least in such cases — meaningful information about the logic involved, as well as the significance and the intended consequences of such processing for you. If the personal data were not collected from you, you have the right to be provided with all available information regarding the origin of the data.
Furthermore, you have the right to be informed as to whether personal data have been transferred to a third country or to an international organisation. If this is the case, you also have the right to be informed of the appropriate safeguards relating to the transfer.
You have the right to request the immediate rectification of inaccurate personal data concerning you.
You have the right to request that we erase personal data concerning you without delay, provided that one of the following grounds applies and insofar as the processing is not necessary:
The personal data has been collected or otherwise processed for purposes for which it is no longer necessary.
The data subject withdraws their consent on which the processing was based in accordance with Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, and there is no other legal basis for the processing.
The data subject objects to the processing in accordance with Article 21(1) of the GDPR, and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing in accordance with Article 21(2) of the GDPR.
The personal data has been processed unlawfully.
The erasure of the personal data is necessary for compliance with a legal obligation under Union law or the law of the Member States to which the controller is subject.
The personal data was collected in relation to information society services offered in accordance with Article 8(1) of the GDPR.
If any of the above grounds apply and you wish to request the erasure of personal data stored by us, you may contact our Data Protection Officer at any time. Our Data Protection Officer, or a member of staff appointed by them, will ensure that the request for erasure is complied with without delay.
If the personal data has been made public by us and our company, as the data controller, is obliged to erase the personal data in accordance with Article 17(1) of the GDPR, we shall take appropriate measures, including technical measures, taking into account the available technology and the costs of implementation, to inform other data controllers who are processing the published personal data that you have requested those other data controllers to delete all links to your personal data or any copies or replicas of your personal data, insofar as the processing is not necessary. Our Data Protection Officer or a member of staff appointed by them will take the necessary steps on a case-by-case basis.
You have the right to request that we restrict processing if any of the following conditions apply:
You contest the accuracy of the personal data, for a period enabling us, as the data controller, to verify the accuracy of the personal data.
The processing is unlawful; you object to the erasure of the personal data and instead request the restriction of the use of the personal data.
We, as the data controller, no longer require the personal data for the purposes of processing, but you, as the data subject, require it to establish, exercise or defend legal claims.
You have objected to the processing in accordance with Article 21(1) of the GDPR, and it has not yet been determined whether our legitimate grounds override your interests as the data subject.
If any of the above conditions are met and you wish to request the restriction of personal data stored by us, you may contact our Data Protection Officer at any time. Our Data Protection Officer, or a member of staff appointed by them, will arrange for the processing to be restricted.
You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us, as the controller to whom the personal data was provided, provided that the processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR or on a contract pursuant to Article 6(1)(b) of the GDPR, and the processing is carried out by automated means, provided that the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us as the controller.
Furthermore, when exercising your right to data portability under Article 20(1) of the GDPR, you have the right to have the personal data transferred directly from one controller to another, provided this is technically feasible and does not adversely affect the rights and freedoms of others.
To exercise your right to data portability, you may contact our Data Protection Officer at any time.
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) or (f) of the GDPR. This also applies to profiling based on these provisions.
If you have any questions regarding this statement or the processing of your personal data by our company, please contact us by email at post@rotflueh.com

Innsbruck, 5 August 2024